Certification readiness — and the audit itself
Gap assessment against the standard, a remediation plan your team can actually execute, the evidence pack, and an engineer sitting beside you on the day the auditor arrives. We do not hand over a report and leave.
The certifications we take clients through
Each one has its own language, its own evidence and its own auditor. We work to all five.
ISO/IEC 27001
The information security management system standard. Scope, risk treatment, Annex A controls, internal audit, Stage 1 and Stage 2.
Read morePCI DSS
For anyone who stores, processes or transmits cardholder data. Scope reduction, segmentation testing, SAQ or ROC, quarterly scanning.
Read moreSOC 2 Type II
The report your enterprise customers ask for. Trust Services Criteria, control design, and an observation window that has to hold.
Read moreTISAX
Required across the automotive supply chain. VDA ISA self-assessment, assessment level, and the ENX label at the end.
Read moreSaudi Aramco CCC
SACS-002 third-party cybersecurity compliance, for suppliers who need the Cybersecurity Compliance Certificate to keep bidding.
Read moreFour stages, and we are there for all four
The same shape every time, whichever standard you are going for.
1. Gap assessment
We read your environment against the actual control set — not a questionnaire. Policies, systems, access, logging, suppliers, physical. You get a gap register with every finding rated and owned.
2. Remediation
The plan, and the hands to do it. We write the policies, build the ISMS, fix the technical gaps, and configure what needs configuring. Your team is not left with a to-do list they have no time for.
3. Evidence and internal audit
Certification is decided on evidence. We build the pack, run the internal audit, close the findings and take you through management review before anyone external sees it.
4. The external audit
We attend. We answer the technical questions, produce the evidence the auditor asks for, and handle the non-conformities if any come up.
Clients we have taken through to a passed audit
Every organisation below reached certification. We ran the gap assessment, did the remediation with them, and attended the external audit. Client names are withheld; sectors only.
ISO 27001
Three organisations certified. Renewable energy, geoscience, and contact centre outsourcing. Gap assessment, ISMS build, remediation, internal audit, and Stage 1 and Stage 2 attended with them.
PCI DSS
Two organisations. ePayment and fintech, and contact centre outsourcing. Both taken through scope reduction before a single control was remediated.
SOC 2 Type II
One organisation in contact centre outsourcing. Criteria selection, readiness, and the full observation window run month by month.
TISAX
One organisation in automotive and embedded systems engineering. VDA ISA self-assessment through to the ENX label.
Saudi Aramco CCC and CCC+
One organisation, both levels. Automotive, embedded systems and high performance computing. SACS-002 applicability, remediation and the certification assessment.
ISO 9001
Supported alongside information security work in the automotive and embedded systems engineering sector, where the client was pursuing both at once.
Readiness is not the same as a certificate
Plenty of consultants will get you audit-ready. The gap between ready and certified is where engagements usually fall apart.
- We have taken clients from first gap assessment through to a passed external audit — and stayed with them through surveillance audits afterwards.
- We are an IT services company, not only a consultancy. When the gap is technical — segmentation, logging, backup, identity, endpoint — we fix it ourselves rather than writing it up for someone else.
- The evidence pack is built as we go, not assembled in a panic the week before the auditor arrives.
- One team owns the whole thing. No hand-off between the people who assessed you and the people who fix it.
- If you are already certified, we run the surveillance cycle, internal audits and management reviews so the certificate does not lapse.
The questions we get most
How long does certification take?
For ISO 27001 in a mid-sized organisation, three to six months from gap assessment to Stage 2 is realistic if the remediation work is resourced. SOC 2 Type II adds an observation window on top — typically three to twelve months of the controls actually operating. PCI DSS depends entirely on how much of your environment is in scope.
Can you reduce the scope instead?
Often that is the cheapest win available, especially with PCI DSS. Segmenting the cardholder data environment properly can move you from a full report on compliance to a self-assessment questionnaire. We look at scope before we look at controls.
We failed an audit before. Can you pick it up?
Yes. Bring the non-conformity report. We work through what was actually raised, fix it, and take you back in.
Do you issue the certificate?
No, and neither does any consultant who tells you otherwise. Certification bodies and authorised assessors issue certificates. We get you to the point where they can.
Do you cover Egypt’s data protection law as well?
Yes. Law 151 of 2020 sits alongside these standards rather than replacing them, and the control work overlaps heavily. We map both at the same time so you are not doing it twice.
Start with the gap assessment.
Before you commit to a standard, find out how far away you actually are. Call and talk it through with an engineer who has sat in the audit room.
02 3537 5791